vpn.sys

Malicious Microsoft Windows Hardware Compatibility Publisher 2022-02-09 11:35 VT 36/73

Driver Name: vpn.sys
MD5: 561bc6902367d9e43e27c5543e7a5818
SHA1: 499b1ede600a8f639e4636e9368e41800cd8ec98
SHA256: 00a0a09e08abca816857c446f88972ea78a3cee9833980df48b069f9612ba727
Imphash: c4110de9fddcb44c9133bf3e705b09c7
Vhash: 016096555d15766656651iz7cxz
Authentihash: 07895544ab19afd67eabb0a564fd86cef93cd412cff4f80bd413091d76991b33
Rich PE header hash: 94abe3e3ca0d54256b06ed5f0b338030
SSDEEP: 24576:Cc0ufmtmXgWr/knaiRovyg04YzEkTNk0eQt9dqLvRSN1y6dvY:f0ITQ4liITfPGu0eQtos62vY
TLSH: T1B9559E7DE3477358CC2A84705137B846F1B12E1D42EC8FAAF3D6FBA07BA65609509B09
Signer: Microsoft Windows Hardware Compatibility Publisher
Signing date: 2022-02-09 11:35
SpcSpOpusInfo: 厦门恒信卓越网络科技有限公司
VT detections: 36/73
Compilation time: 2022-02-09
PDB path: D:\speeder\speeder\vpn\Mydriver\MyDriver1\x64\Release\wfp_vpn.pdb
Country submitter: China
Flag: Malicious

Description

A kernel loader rootkit that communicates with a large command-and-control (C&C) infrastructure to source a second-stage kernel driver used to conduct its main malicious intent. The unsigned kernel driver's functions vary from defense evasion (disabling security products), to a proxy redirector that reroutes network traffic to attacker-controlled C2 servers, to injecting JavaScript into web pages to redirect browser data.